CVE-2020-6514: apple ipados

CVSS: 6.5v3.1MediumModified

AliasesUBUNTU-CVE-2020-6514DEBIAN-CVE-2020-6514

Published 22-07-2020Last modified 04-08-2024

Vulnerability summary

CVE-2020-6514 is a medium (CVSS 6.5) vulnerability in apple ipados. EPSS estimates a 7.79% chance of exploitation in the next 30 days, higher than 94.6% of scored vulnerabilities. 2 public exploits are recorded.

Overall risk

38/100

0100

Medium · default modelHow is this calculated?

CVSS score

6.5/10

010

Medium · v3.1 (NVD)

EPSS score

7.79%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits2reference

Timeline

22-07-2020
PublishedVulnerability first disclosed.
04-08-2024
Last modifiedVulnerability information updated.

Description

Inappropriate implementation in WebRTC in Google Chrome prior to 84.0.4147.89 allowed an attacker in a privileged network position to potentially exploit heap corruption via a crafted SCTP stream.

CVSS metrics

4 scores · 3 sources · 2 versions

v3.16.5v2.04.3

EPSS trend

Probability

7.79%

Chance of exploitation in the next 30 days

Percentile

95%

Versus all other CVEs

30-day change

0.00 pp

From 7.79% on 19-09-2026

19-09-202619-10-2026

EPSS score

7.79%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

2 found

referenceUnverified
Exploit Reference (crbug.com)
Maturity: unknown
referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Affected systems

Apple5 products

ipados< 13.6
iphone_os< 13.6
safari< 13.1.2
tvos< 13.4.8
watchos< 6.2.8

Debian4 products

chromium< 87.0.4280.88-0.1
firefox-esr< 68.11.0esr-1
thunderbird< 1:68.11.0-1
debian_linuxEOL9.0 | 10.0

Ubuntu3 products

chromium-browser< 84.0.4147.105-0ubuntu0.16.04.1 | < 84.0.4147.105-0ubuntu0.18.04.1
firefox< 79.0+build1-0ubuntu0.16.04.2 | < 79.0+build1-0ubuntu0.18.04.1 | < 79.0+build1-0ubuntu0.20.04.1
thunderbird< 1:78.8.1+build1-0ubuntu0.18.04.1 | < 1:78.7.1+build1-0ubuntu0.20.04.1

Opensuse2 products

backports_sle15.0:sp1 | 15.0:sp2
leapEOL15.1 | 15.2

Canonical1 product

ubuntu_linuxEOL16.04 | 18.04 | 20.04

Fedoraproject1 product

fedoraEOL31 | 32

Google1 product

chrome≥ unspecified, < 84.0.4147.89 | < 84.0.4147.89

7 vendors · 17 products

References

33 links

support.apple.com/kb/HT211288X Refsource CONFIRMThird Party Advisory
support.apple.com/kb/HT211290X Refsource CONFIRMThird Party Advisory
support.apple.com/kb/HT211291X Refsource CONFIRMThird Party Advisory
support.apple.com/kb/HT211292X Refsource CONFIRMThird Party Advisory
chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop.htmlX Refsource MISCRelease NotesVendor Advisory
crbug.com/1076703X Refsource MISCExploitIssue TrackingVendor Advisory
lists.opensuse.org/opensuse-security-announce/2020-07/msg00069.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
security.gentoo.org/glsa/202007-08Vendor AdvisoryX Refsource GENTOOThird Party Advisory
lists.debian.org/debian-lts-announce/2020/07/msg00027.htmlMailing ListX Refsource MLISTThird Party Advisory
www.debian.org/security/2020/dsa-4736Vendor AdvisoryX Refsource DEBIANThird Party Advisory

Show all 33 references

lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORA
security.gentoo.org/glsa/202007-64Vendor AdvisoryX Refsource GENTOOThird Party Advisory
packetstormsecurity.com/files/158697/WebRTC-usrsctp-Incorrect-Call.htmlX Refsource MISCExploitThird Party AdvisoryVDB Entry
lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORA
lists.debian.org/debian-lts-announce/2020/08/msg00006.htmlMailing ListX Refsource MLISTThird Party Advisory
www.debian.org/security/2020/dsa-4740Vendor AdvisoryX Refsource DEBIANThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2020-08/msg00008.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2020-08/msg00007.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2020-08/msg00011.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2020-08/msg00018.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2020-08/msg00022.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2020-08/msg00025.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2020-08/msg00032.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
usn.ubuntu.com/4443-1/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2020-09/msg00041.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
www.debian.org/security/2021/dsa-4824Vendor AdvisoryX Refsource DEBIANThird Party Advisory
security.gentoo.org/glsa/202101-30Vendor AdvisoryX Refsource GENTOOThird Party Advisory
ubuntu.com/security/CVE-2020-6514REPORT
www.mozilla.org/en-US/security/advisories/mfsa2020-30/REPORT
www.mozilla.org/en-US/security/advisories/mfsa2020-35/REPORT
ubuntu.com/security/notices/USN-4443-1Advisory
www.cve.org/CVERecord?id=CVE-2020-6514REPORT
security-tracker.debian.org/tracker/CVE-2020-6514Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities